From 539d0f867e3b6f4b9a2b419cd8c70b6329fb9a44 Mon Sep 17 00:00:00 2001
From: Marius Balteanu <marius.balteanu@zitec.com>
Date: Thu, 21 Dec 2023 06:47:32 +0000
Subject: Explicitly render a 404 on non-JS requests to @watchers#new@
 (#39894).

Patch by @hjust.

git-svn-id: https://svn.redmine.org/redmine/trunk@22538 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 app/controllers/watchers_controller.rb | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'app')

diff --git a/app/controllers/watchers_controller.rb b/app/controllers/watchers_controller.rb
index 58c875b0c..dbacb5c76 100644
--- a/app/controllers/watchers_controller.rb
+++ b/app/controllers/watchers_controller.rb
@@ -32,7 +32,12 @@ class WatchersController < ApplicationController
   accept_api_auth :create, :destroy
 
   def new
-    @users = users_for_new_watcher
+    respond_to do |format|
+      format.html { render_404 }
+      format.js do
+        @users = users_for_new_watcher
+      end
+    end
   end
 
   def create
-- 
cgit v1.2.3